Little Pieces Virus
Virus Name: Little Pieces
Aliases: 1374, Pieces
V Status: Rare
Discovered: January, 1991
Symptoms: .COM & .EXE growth; decrease in available free memory;
message; system hangs; unexpected screen clears
Eff Length: 1,374 Bytes
Type Code: PRaE - Parasitic Resident .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected programs
The Little Pieces virus was isolated in January, 1991, in Italy.
This virus is a 1,374 byte memory resident infector of .EXE files.
The first time a program infected with Little Pieces is executed,
the virus will install itself memory resident. The area where it
is memory resident is 1,392 bytes long and labeled COMMAND Data in
low system memory. Some memory mapping utilities will combine this
area with the command interpreter, so the command interpreter will
appear to be 1,392 bytes longer than expected. Interrupts 13, 16,
and 21 are hooked by the Little Pieces virus.
Once Little Pieces is memory resident, it will infect .EXE programs
as they are executed. Infected .EXE programs will increase in size
by 1,374 bytes and have the virus located at the end of the
infected file. Infected files will not have their date and time in
the disk directory altered.
Systems infected with the Little Pieces virus may experience the
system display being cleared unexpectedly after a key is pressed on
the keyboard. The following message is usually displayed after the
screen is cleared, though not always:
"One of these days I'm going to cut you into little pieces"
This message cannot be viewed in infected files as it is encrypted
within the virus.
Infected system may also experience unexpected system hangs
occurring, requiring the system to be rebooted. These hangs
sometimes occur after the above message is displayed.